AdvDebug
7a72cdabbd
Adds a persistent TCG code cache to Unicorn via a version-portable build-time patch system, plus the TCG and Android work that came out of making it releasable. Patch infrastructure. Brovan/native/unicorn/ holds Brovan's additions to the Unicorn tree; Brovan.Unicorn.targets applies them after extraction through a RoslynCodeTaskFactory inline task — no git/patch/python dependency, works on Windows, Linux and Android build hosts. Edits are single-line anchors and whole-file appends rather than hunks, so they survive upstream drift; every rule is idempotent, and a missing anchor fails the build naming all misses. The patch-set hash is part of the source and build directory names, so editing a patch forces a clean re-extract. Validated against the previous two Unicorn tags. Code cache. Saves the TCG buffer and reloads it on the next launch. Helper addresses route through an indirect slot table; uc/tcg_ctx are pinned in a replayed address reservation chosen from a probed candidate list. Every restored block is re-verified against the guest bytes it was translated from, and page_addr/hash are recomputed from the live mapping so self-modifying-code invalidation still finds them. A save-time audit scans emitted code for host pointers a reload could not repoint and refuses rather than writing a poisoned blob — it caught a real miss (the i386 backend tail-jumps into qemu_st_helpers rather than calling it). Blocks in pages the loader hasn't reached yet are retried later instead of re-translated, and the blob is dropped once mostly dead code, bounding growth. Inline hooks stay enabled. Slots carry a kind — image-relative for helpers, hook identity for callbacks re-resolved from uc->hook[] on load — so the cache no longer has to disable Unicorn's inline-hook path. That was costing ~13% throughput. Per-block exit poll inlined. Unicorn calls a helper on every block to test icount_decr; this emits a load and a not-taken branch, with the helper kept for the slow path, following QEMU's shape of branching out of the block to a trailing label. Direct register access. brov_reg_ptr hands out host pointers into the guest CPU state, used by ReadRegister/WriteRegister through unsafe loads and stores. Only registers Unicorn stores verbatim are exposed, and only those it would write with a plain store are writable — the program counter is read-only because writing it also raises quit_request and flushes blocks, and nothing is exposed in 16/32-bit mode where the same storage is reached under different truncation rules. Android. JIT caching switch in Settings, default on. The Vulkan shim is a guest PE, so it now ships as an APK asset and is deployed into the guest's System32/SysWOW64 on launch, refreshed on app update. The cross-build no longer shares a CMake cache with the host build. API set map from the installed image. Read from the .apiset section of the imported apisetschema.dll instead of being dumped from the host or synthesised, so the contract names match the DLLs actually installed. Regenerated when the schema is newer than the map.
A user-mode x86_64 binary emulator for inspecting programs, tracing syscalls, and safely running untrusted software.
What is Brovan?
Brovan is an interactive x86_64 emulator that gives you full control over how programs execute. It can be used to reverse engineer binaries, trace API and system calls, capture network traffic, or run software in an isolated environment without executing it directly on your host CPU.
It is designed to support as much software as possible while remaining a safe, efficient, and high-performance option for running software across Windows and Linux. Brovan is still in early development, so it is not yet fully mature or reliable.
Supported backends:
- Unicorn Engine for cross-platform emulation
- WHP (Windows Hypervisor Platform) for hardware acceleration on Windows
- KVM (Kernel-based Virtual Machine) for hardware acceleration on Linux
Core Features
|
MULTI-FORMAT LOADING Load and execute binaries directly inside the emulator without host installation. PE ELF Memory Dumps Raw Shellcode
|
BROVVULK GRAPHICS LAYER Custom Vulkan translation subsystem handling DXVK calls and game rendering. DXVK DirectX Vulkan Surface
|
|
SYSCALL & API TRACING Inspect execution live to see what functions, DLLs, and kernel calls the program accesses. Kernel Syscalls Symbol Resolving Loaded DLLs
|
NETWORK DUMPING Intercept guest socket traffic and export network activity for payload analysis. Socket Intercept PCAP Capture Traffic Analysis
|
Previews & Demos
Gaming & Graphics (Brovvulk)
Brovan can render guest graphical applications through its Brovvulk translation subsystem. Here is a sample game i had (Deltarune), but it can work on many other games:
|
|
Deltarune Bring-up
|
Binary Execution & Tracing
|
Linux ELF on Windows Running fastfetch cross-platform
|
Syscall Tracing Live logs of API calls and dynamic symbols |
Raw Binaries Executing shellcode and memory dumps |
Network Inspection
|
Network Capture Intercepting guest socket reads and writes |
Traffic Analyzer Viewing dumped PCAPs and payloads |
Documentation & Wiki
Check out the GitHub Wiki for:
- Building from source
- Architecture details
- Command reference and usage guides
- FAQ
Warning
The Releases page may not always have the latest changes.
For the most up-to-date version, build from source instead or use the latest build from GitHub Actions
Credits
Thanks to Iced library for x86_64 disassembly and assembly.
Thanks to Unicorn Engine for the core emulator.
Thanks to my friend GittingHubbers for help with the MLFQ Scheduler.
License
GPL-2.0